基于马尔科夫链的主机异常检测方法研究  

An Anomaly Detection Method Based on Markov Model

作　　者：刘永庆[1] 刘东生[1] 

机构地区：[1]海军计算技术研究所,北京100841

出　　处：《计算机与数字工程》2010年第7期20-23,共4页Computer & Digital Engineering

摘　　要：提出了基于马尔科夫链模型的主机异常检测方法,首先提取特权进程的行为特征,并在此基础上构造Markov模型。由Markov模型产生的状态序列计算状态概率,根据状态序列概率来评价进程行为的异常情况。利用Markov模型的构造充分提取特权进程的局部行为特征的相互关系。实验表明该模型算法简单、实时性强、检测率高、误报率低、适合用于在线检测。A new method for anomaly intrusion detection is proposed based on Markov model.At first,behavioral features are extracted from the privileged processes,and then the Markov model is founded based on the features.The state sequences of Markov model are analyzed to infer the state probability,which is used to classify the normal or abnormal behavior.It can extract the relationships of local behavioral features of the privileged processes adequately.When the training sets are limited,the method predicts exactly.The experiments show this method is simple,effective and efficient,and can be used in practice to monitor the computer system in real time with high TPR and low FPR.

关 键 词：异常检测 马尔科夫链模型 系统调用序列 网络安全 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]